Last updated 11 October 2026.
We make WordPress software, host websites, and run an analytics service that gathers a website’s own figures from Google, Microsoft, Cloudflare, YouTube, Instagram, Facebook and TikTok into one place for the people who run that website.
You can reach us about anything in this policy at [email protected].
connect.presskit.live in Australia and never leaves our systems. Our analytics service receives only short-lived access tokens, and only the figures.This policy covers:
presskit.live and its subdomains, including connect.presskit.live;It does not cover the visitors to a customer’s own website. For them, we act as a service provider to that customer: we process their data on the customer’s instructions and under the customer’s privacy policy, and we use it for nothing else.
Our web server and Cloudflare, which sits in front of it, record the ordinary request details: your IP address, the page asked for, the time, and your browser’s description of itself. We use these to run and secure the site. presskit.live carries no advertising or analytics tag.
Your name, business name, email address and phone number, what you tell us in support correspondence, and the details of what you have asked us to build, host or install. If we invoice you, the details on the invoice. The administrator accounts on a site we host are created at your request and belong to you.
A site running Presskit Live checks presskit.live for updates and downloads them from there. We see the request’s address, the site’s address and the plugin versions it asks about. The Software sends us nothing else: no content, no visitor data, no settings.
Analytics reads figures from the services you choose to connect. For each, it reads only what the permissions you grant allow, and it stores only what is listed here.
Google.
One Google sign-in may cover up to five read-only services, each shown on Google’s consent screen and each refusable:
Meta.
The Facebook Pages you choose and the Instagram professional accounts linked to them: the Page’s or account’s id, name, follower count and daily reach, views and new follows; and each post’s id, caption, type, permalink, thumbnail address, publish time, and its running totals of views or plays, reach, likes, comments, shares and saves.
TikTok.
Your account’s id, display name, avatar address, follower, following, likes and video counts; and each public video’s id, title, cover image address, publish time, duration, share address, and its running totals of views, likes, comments and shares.
Running totals from Meta and TikTok are recorded once a day as a snapshot, so that the day’s change can be worked out. Nothing is read about who viewed, liked or commented. We never read messages, comments’ text, or your audience’s identities.
Microsoft Bing Webmaster Tools and Cloudflare Web Analytics.
Where a customer gives us an API key: the site’s daily clicks and impressions by page and query, and its daily page views and web vitals. Both are aggregated figures with no record of any individual visitor.
When you connect an account, the provider gives Connect a refresh token (Meta gives a long-lived token instead). Connect stores it encrypted with a key held only in that service’s environment. It is never written anywhere in plain text, never logged, and never sent to any other system, including our own analytics service. When Analytics needs to read your figures it asks Connect for a short-lived access token, keeps it in memory for at most the time the provider allows, and discards it. The API keys a customer gives us for Bing and Cloudflare are held encrypted in our deployment configuration.
We use what we collect to:
We do not sell data, share it with advertisers or data brokers, use it to serve or target advertising, or use it to assess anyone’s creditworthiness. We do not combine figures from different customers, and one customer’s figures are never shown to another. No person at Presskit reads a customer’s figures except to support that customer at their request or to investigate a security problem. We do not use connected-account data to train or improve any model.
Presskit’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
In particular: we use Google user data only to provide the features described in § 4.4 and § 5 to the customer who connected the account; we transfer it to no one except as needed to provide those features (the customer’s own analytics service), for security, or where the law requires; no human at Presskit reads it except as § 5 allows; and we never use it for advertising.
Presskit uses YouTube API Services.
By connecting a YouTube channel you also agree to the YouTube Terms of Service and Google’s handling of your data is described in the Google Privacy Policy. Besides disconnecting in Presskit SEO (§ 12), you can revoke Presskit’s access to your Google data at any time on the Google security settings page. The YouTube statistics we store are kept for as long as the connection stands, and every 30 days we confirm that we are still authorised to hold them; a video’s title, description and thumbnail are refreshed or removed within 30 days. When a connection is revoked, collection stops and the data is deleted as § 12 describes.
Data we receive from Meta and TikTok about your Pages, accounts and posts is processed on your behalf and at your direction, is kept separate from every other customer’s, and is used for nothing but the features described here. We keep it only as long as § 10 says, and delete it when you disconnect or ask us to (§ 12). Your use of those platforms remains subject to their own terms and privacy policies.
Only the service providers that run our systems, each for the stated purpose and nothing more:
We disclose data where the law requires it, and we will tell you if we do unless the law prevents it. If Presskit is sold or merged, data passes to the new owner only under this policy, and we will tell you first.
Our servers are in Australia. Connected-account tokens and collected figures are stored and backed up in Australia. Cloudflare may process request details at the edge location nearest the visitor, and Resend processes email in the United States.
Everything travels over TLS. Tokens are encrypted at rest with AES-256-GCM. Access to our systems is limited to the people who operate them and protected by keys rather than passwords. Backups are encrypted before they leave our servers. Our services are built so that no token or secret appears in a log, an error message or a backup. If a data breach is likely to cause serious harm we will notify the people affected and the Office of the Australian Information Commissioner as the Notifiable Data Breaches scheme requires.
To disconnect an account: in your site’s WordPress admin open Presskit SEO > Settings > Analytics > Connections and choose Disconnect beside the service.
We revoke our access with the provider, overwrite the stored token, and stop collecting from that account the same day.
You can also remove our access from the provider’s side at any time:
To delete your data email [email protected] from an address associated with your account, naming the site and the accounts concerned. Within 30 days we will delete the connection records, the figures collected from those accounts, and any copies in our live systems, and confirm by email. Backups age out on the schedule in § 10. If you only want to delete the data for one Page or account while keeping another, say so and we will do that instead. A customer who ends their service with us is offered an export first, then deleted the same way.
We handle personal information under the Australian Privacy Act 1988 and the Australian Privacy Principles. You may ask for access to the personal information we hold about you, ask us to correct it, or complain about how we have handled it, by writing to [email protected]. We answer within 30 days. If you are not satisfied with our answer you may complain to the Office of the Australian Information Commissioner. If you are in the United Kingdom or the European Economic Area you have the corresponding rights under the UK GDPR or the GDPR, including the right to object and to data portability, and the same address reaches us.
presskit.live sets WordPress’s own cookies only when someone signs in to its admin, and Cloudflare may set its bot-protection cookie (__cf_bm) for a short time. We set no advertising or analytics cookies. Presskit Connect sets no cookies: a sign-in is carried by a short-lived, single-use code in the address.
Our services are business tools and are not directed at children. We do not knowingly collect personal information from anyone under 16.
We will post any change on this page with a new date at the top, and tell customers by email about any change that affects how we handle their data at least 14 days before it takes effect.
Email [email protected]